HPE StoreOnce - Encrypted Backup Copies poor Dedupe ratio

[TimLawhead]

I am seeing very poor dedupe ratios on one of my HPE StoreOnces.

I recently turned on backup encryption and I knew it was going to create a new full, but I am wondering if the encrypted backup chains are capable of being deduplicated with a good ratio or not.

TIA

[rennerstefan]

Hi,

yes it is expected that the deduplication ratio is not as Good on such appliances as soon as veeam encryption is enabled, simply because encrypted files (same for highly compressed files) can’t be deduplicated much.
You can find the details on page 5 of the following guide:
https://www.hpe.com/psnow/doc/a00023056enw

In that guide you can also find more best practices on Veeam and HPE storeonce.

Thanks

[TimLawhead]

I was hoping to move to a single copy of my source data for backups. We currently are writing an encrypted chain to a local disk storage that then gets sent to tape, and had been running a separate backup/backup copy chain for the StoreOnce data.

With Veeam 11, it was my understanding that the HPE Catalyst Copy (CC) would now work for backup copy jobs, which would be an immediate mirror copy from the local disk storage up to the StoreOnce and then CC would replicate it over to the other StoreOnce. It did appear to be working, but then hosed up my StoreOnces due to not deduping.

For compliance reasons I need to maintain encrypted backups.... Am I out of luck with the desired backup process? Would I need to stay with the dual hits against the source to keep the StoreOnce chain unencrypted then?

[foggy]

Hi Tim, you need to configure your Immediate backup copy to decrypt the backups prior to writing them to StoreOnce. This way the Catalyst Copy job will then mirror unencrypted backups and those will be deduplicated.

[rennerstefan]

As mentioned by my colleague there are different ways and things to keep in mind if the data needs to be encrypted.
Decrypting it before landing on the storeonce would be needed to still see good dedup rates on it.
You may need to think about using the encryption feature on the storeonce instead. It is also explained in the guide.
Also keep in mind that any encryption and decryption process will consume some performance on your devices and servers.

[TimLawhead]

Hi Tim, you need to configure your Immediate backup copy to decrypt the backups prior to writing them to StoreOnce. This way the Catalyst Copy job will then mirror unencrypted backups and those will be deduplicated.

So to confirm... If I disable Encryption on the Backup Copy Job going from the Disk Storage (Windows Backup Repo), the Veeam agents on the Disk Storage server will then unencrypt the backups before it sends them to the StoreOnce unit, and as mentioned by rennerstefan I will still be covered by having the encryption feature of the StoreOnce turned on for the Catalyst Store.

[foggy]

Correct. My statement was a bit vague - you just need to disable encryption in the backup copy job, it will anyway decrypt those prior to copying data.

[TimLawhead]

Looking to better understand the chain of encryption between Backup jobs and Backup Copy jobs.

Hi Tim, you need to configure your Immediate backup copy to decrypt the backups prior to writing them to StoreOnce. This way the Catalyst Copy job will then mirror unencrypted backups and those will be deduplicated.

I'm trying to follow some logic here... If your initial backup job is done with Encryption on, then if you are doing a backup copy job and the backup copy job doesn't have encryption enabled... the veeam agents will then decrypt it and send it over, rather than just copying the already encrypted file?

I'm looking at my immediate copy from Site B to Site A so they can be picked up by the Tape job... When I went to check it... I got a notice that says, "Source Backup job has encryption enabled. Consider enabling encryption for Backup Copy Job as well." Does that mean the data from Site B at Site A is not encrypted then?

Resource Use question - If it is the case that the Site B data at Site A isn't encrypted, and I turn that on in the Backup Copy job... Does Veeam just copy the encrypted data over, or does decrypt/encrypt the data again during the process of the Backup Copy job. (Regardless I want it encrypted.)

[foggy]

Correct, backup copy job decrypts the data and re-encrypts it with its own key prior to sending it to the target repository (if encryption is enabled in the backup copy job settings).

[Watts]

We have our 1st copy to JBOD encrypted by Veeam.
We have immediate copy jobs pointing to a few off-site StoreOnce Catalyst stores which have the encryption in Veeam disabled.
We rely on the StoreOnce Catalyst encryption and we get ~10/1 on most loads with SQL and Oracle data doing ~40/1.
As of this release there is no integration for the Immutability feature on Catalyst, which would be about bulletproof IMO.

[rennerstefan]

Hi Watts,

as for the immutability with Catalyst you can find some informations in this thread where we also commented about it:
veeam-backup-replication-f2/is-support- ... ml#p429009

Thanks